import { ContentByFramework, CodeGroup } from '@/components/forMdx'

export const metadata = {
  description: "Add groups as members of other groups."
};

# Groups as members

Groups can be added to other groups using the `addMember` method.

When a group is added as a member of another group, members of the added group will become part of the containing group.

## Basic usage

Here's how to add a group as a member of another group:

<CodeGroup>
```ts index.ts#Basic
```
</CodeGroup>

When you add groups as members:
- Members of the added group become members of the container group
- Their roles are inherited (with some exceptions, see [below](#the-rules-of-role-inheritance))
- Revoking access from the member group also removes its access to the container group

## Levels of inheritance

Adding a group as a member of another is not limited in depth:

<CodeGroup>
```ts index.ts#Inheritance
```
</CodeGroup>

Members of the grandparent group will get access to all descendant groups based on their roles.

## Roles

### The rules of role inheritance

If the account is already a member of the container group, it will get the more permissive role:
<CodeGroup>
```ts index.ts#RuleOfMostPermissive
```
</CodeGroup>

When adding a group to another group, only admin, writer and reader roles are inherited:
<CodeGroup className="[&_span]:whitespace-normal">
```ts index.ts#WriteOnlyOmitted
```
</CodeGroup>

### Overriding the added group's roles

In some cases you might want to inherit all members from an added group but override their roles to the same specific role in the containing group. You can do so by passing an "override role" as a second argument to `addMember`:

<CodeGroup>
```ts index.ts#Overrides
</CodeGroup>

The "override role" works in both directions:

<CodeGroup>
```ts index.ts#OverrideContainers
```
</CodeGroup>

### Permission changes

When you remove a member from an added group, they automatically lose access to all containing groups. We handle key rotation automatically to ensure security.

<CodeGroup>
```ts index.ts#RemoveMembers
```
</CodeGroup>

## Removing groups from other groups

You can remove a group from another group by using the `removeMember` method:

<CodeGroup className="[&_span]:whitespace-normal">
```ts index.ts#RevokeExtension
```
</CodeGroup>

## Getting all added groups

You can get all of the groups added to a group by calling the `getParentGroups` method:

<CodeGroup className="[&_span]:whitespace-normal">
```ts index.ts#GetParentGroups
```
</CodeGroup>

## Ownership on implicit CoValue creation

When creating CoValues that contain other CoValues (or updating references to CoValues) using plain JSON objects, Jazz not only creates
the necessary CoValues automatically but it will also manage their group ownership.

<CodeGroup>
```ts index.ts#ImplicitOwnership
```
</CodeGroup>

For each created column and task CoValue, Jazz also creates a new group as its owner and
adds the referencing CoValue's owner as a member of that group. This means permissions for nested CoValues
are inherited from the CoValue that references them, but can also be modified independently for each CoValue
if needed.

<CodeGroup>
```ts index.ts#ManageImplicitPermissions
```
</CodeGroup>

If you prefer to manage permissions differently, you can always create CoValues explicitly:

<CodeGroup>
```ts index.ts#ExplicitPermissions
```
</CodeGroup>

## Example: Team Hierarchy

Here's a practical example of using group inheritance for team permissions:

<CodeGroup>
```ts index.ts#TeamHierarchy
```
</CodeGroup>

This creates a hierarchy where:
- The CEO has admin access to everything
- Team members get writer access to team and project content
- Team leads get admin access to team and project content
- The client can only read project content
